prefixset

A prefixset is a collection of IP prefixes, typically expressed in CIDR notation, used to classify addresses or routes in networking and security policies. It serves as a single object that can be consulted to determine whether a given IP address or route falls within any of the prefixes it contains. Prefixsets are commonly employed to implement allow/deny decisions, route filters, access control lists, and policy-based routing.

A prefixset can be implemented in multiple ways depending on the environment and performance requirements. Software implementations often use data structures such as radix (patricia) tries, interval trees, or sorted lists to support fast membership tests. Hardware or policy engines may compile a prefixset into a finite-state machine or a compact decision table to speed up lookups. Prefixes in a set can be IPv4, IPv6, or both, and operations may include unions, intersections, and subsetting.

Core operations on a prefixset include adding or removing prefixes, checking whether an address or another prefix is contained, and testing for overlap or redundancy among prefixes. Performance characteristics depend on the chosen representation; tries typically provide efficient longest-prefix matching, while simple arrays may suffice for small sets.

Common applications include firewall rules, router policy filtering, and cloud networking where centralized prefix abstractions simplify management of large numbers of routes or addresses. For example, a prefixset might represent the ranges of IPs that are allowed to access a service, while another set represents restricted addresses.

See also: prefix-list, access-control list, CIDR, longest-prefix match, routing policy.